Malware Analysis Report

2024-11-15 06:11

Sample ID 240407-3lencshh5s
Target 2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber
SHA256 fbed99453a6a3bb1916f2530dfcdc8a1cbb98180545914e5c5b9d92188e704d4
Tags
ransomware spyware stealer
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

fbed99453a6a3bb1916f2530dfcdc8a1cbb98180545914e5c5b9d92188e704d4

Threat Level: Likely malicious

The file 2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber was found to be: Likely malicious.

Malicious Activity Summary

ransomware spyware stealer

Renames multiple (5962) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: LoadsDriver

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Uses Volume Shadow Copy service COM API

Uses Volume Shadow Copy WMI provider

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:35

Reported

2024-04-07 23:38

Platform

win10v2004-20231215-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe"

Signatures

Renames multiple (5962) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\fxssvc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\SensorDataService.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\system32\spectrum.exe N/A
N/A N/A C:\Windows\System32\OpenSSH\ssh-agent.exe N/A
N/A N/A C:\Windows\system32\TieringEngineService.exe N/A
N/A N/A C:\Windows\system32\AgentService.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f56206758ed1090.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{6FB5F2B8-50C9-4E27-9F75-756369A42747}\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\java.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8fcd26b4489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007bd2096c4489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c5ff46b4489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078c4996b4489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f4ce16b4489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2504 wrote to memory of 792 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2504 wrote to memory of 792 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2504 wrote to memory of 1420 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2504 wrote to memory of 1420 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1464 wrote to memory of 10448 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 1464 wrote to memory of 10448 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 1464 wrote to memory of 10448 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 10448 wrote to memory of 13680 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 10448 wrote to memory of 13680 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 10448 wrote to memory of 13680 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 13680 wrote to memory of 13588 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13680 wrote to memory of 13588 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13552 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13552 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13288 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13192 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 13192 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13680 wrote to memory of 12952 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
PID 13680 wrote to memory of 12952 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
PID 13588 wrote to memory of 12888 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 12888 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 12888 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 12888 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 13588 wrote to memory of 12888 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=13680" "-buildid=1709846872" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe" "-launcher=0" --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=DcheckIsFatal"

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1709846872 --initial-client-data=0x368,0x36c,0x370,0x344,0x374,0x7ffebf23ee28,0x7ffebf23ee38,0x7ffebf23ee48

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1660 --field-trial-handle=1732,i,4099752451629212425,12076556204286913681,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2136 --field-trial-handle=1732,i,4099752451629212425,12076556204286913681,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2f4 0x51c

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe

.\bin\gldriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2496 --field-trial-handle=1732,i,4099752451629212425,12076556204286913681,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --first-renderer-process --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1732,i,4099752451629212425,12076556204286913681,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:1

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe

.\bin\gldriverquery.exe

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe

.\bin\vulkandriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe

.\bin\vulkandriverquery.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.steamstatic.com udp
BE 23.14.90.74:443 cdn.steamstatic.com tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 74.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
BE 23.14.90.74:443 cdn.steamstatic.com tcp
BE 23.14.90.74:443 cdn.steamstatic.com tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 171.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 cdn.steamstatic.com udp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
US 8.8.8.8:53 81.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 test.steampowered.com udp
BE 23.14.90.98:80 test.steampowered.com tcp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ipv6check-udp.steamserver.net udp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
US 8.8.8.8:53 98.90.14.23.in-addr.arpa udp
N/A 127.0.0.1:51335 tcp
N/A 127.0.0.1:51328 tcp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
US 8.8.8.8:53 ext4-lhr1.steamserver.net udp
GB 162.254.196.84:27033 ext4-lhr1.steamserver.net tcp
GB 162.254.196.84:27035 ext4-lhr1.steamserver.net tcp
US 8.8.8.8:53 ext2-par1.steamserver.net udp
GB 162.254.196.84:443 ext4-lhr1.steamserver.net tcp
FR 185.25.182.52:27033 ext2-par1.steamserver.net tcp
US 8.8.8.8:53 92.92.68.104.in-addr.arpa udp
US 8.8.8.8:53 84.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 52.182.25.185.in-addr.arpa udp
US 8.8.8.8:53 ext1-par1.steamserver.net udp
FR 185.25.182.20:27031 ext1-par1.steamserver.net tcp
FR 185.25.182.20:443 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 20.182.25.185.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 npukfztj.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:443 dns.google udp
US 34.174.206.7:80 ytctnunms.biz tcp
DE 172.217.16.195:443 tcp
US 8.8.8.8:53 195.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ipv6check-udp.steamserver.net udp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 123.35.104.34.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
US 8.8.8.8:53 ext3-lhr1.steamserver.net udp
GB 162.254.196.68:27031 ext3-lhr1.steamserver.net tcp
GB 162.254.196.68:27029 ext3-lhr1.steamserver.net tcp
GB 162.254.196.84:443 ext4-lhr1.steamserver.net tcp
FR 185.25.182.52:27029 ext2-par1.steamserver.net tcp
FR 185.25.182.52:27034 ext2-par1.steamserver.net tcp
FR 185.25.182.20:443 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 ext2-ams1.steamserver.net udp
NL 155.133.248.39:27028 ext2-ams1.steamserver.net tcp
NL 155.133.248.39:27037 ext2-ams1.steamserver.net tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 68.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 39.248.133.155.in-addr.arpa udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp

Files

memory/1464-0-0x0000000000400000-0x0000000000940000-memory.dmp

memory/1464-1-0x00000000026C0000-0x0000000002727000-memory.dmp

memory/1464-6-0x00000000026C0000-0x0000000002727000-memory.dmp

C:\Windows\System32\alg.exe

MD5 e3ab510f0348695da1ea3874cb7b4fb0
SHA1 2e2da78eb25dcc9ae360de2ad11d32d5051588b2
SHA256 edacd01dff488d98c307100c7a593b615e14d016fedba92c408cfcca249c8239
SHA512 67f3bc1447c6dd005c56424f61359c9db297990dba0980cab0c8e9c2f0e6c5eb299d62c546761b979ed43888f8a5b4d0b1c74354d2278b93be04b369b2a90b24

memory/868-13-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/868-11-0x0000000000500000-0x0000000000560000-memory.dmp

memory/868-19-0x0000000000500000-0x0000000000560000-memory.dmp

memory/1772-25-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/1772-27-0x0000000140000000-0x00000001401E8000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 d96d02502ec703793bf78cc1db4d3b98
SHA1 aa5fb28bdd5fe9d87be728ad622280854ab02885
SHA256 43d9bb3553b4eb4bb1dc4797677851059c9fd62544121de49593c17731f16657
SHA512 b739da7dfc3704f3ce97b9174ed9bb51052e1b11d463d7a3c8f2e12f0376ccd0cc9aa67c883c7a7b54976e911ad0d80c318d538e37c3d185cdf9a9e4ea85c536

memory/1772-32-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 6c4e1e7aecc0e3f72ca4b118cce362c8
SHA1 741b88e092f046bb1630e5ca95904e3c5a890bf9
SHA256 c3caedaa1047c3e6799b6debc2be5aecb2e93936ab40109335c28a7ae9f64173
SHA512 1b4cb9a0e9e18923c49527b2a7e7ab9e038defac0a5bb76831af10b771e8f871281a2d8ca307d226e241475f7ef76247bc24811c2fab74b700089691a65caf44

memory/5028-36-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5028-37-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/5028-44-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/5028-48-0x0000000000EC0000-0x0000000000F20000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 d118e7667428fb887f3f39e7b6cafa84
SHA1 a30322c2cc4294eed9abcb213dbec4e536558f4c
SHA256 ebfd7ef79131fcad88c3bf0199e342f947f13e5e0db5cb3f539fe70490279859
SHA512 ed7ead5e8752358fd2f68ddefc8c7323b70c96437babc5dc06b66b11d8d1caabb88c260a540b75e3351c17fbe381d77e940dfcc335f398c6eaaad2d7d697ae99

memory/1716-54-0x0000000140000000-0x0000000140237000-memory.dmp

memory/5028-53-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1716-52-0x00000000007F0000-0x0000000000850000-memory.dmp

memory/1716-60-0x00000000007F0000-0x0000000000850000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 8a0d5d368a4e228f457c6417c7959242
SHA1 c58d0cece6cb39896e1178cc18133765bc9f48ed
SHA256 a0a737274311a4a38f34af912096ebb3fe0e15f76cb5b1e982662c2af93313d0
SHA512 752236b752e2836584e2c76b682a49bb6fb9aafb89cce39026103f34a72b7fed5cdc06e3f1e90f4961c7f91d260b55537be18ad416f5e5cd8502b7cfd3b7f888

memory/4460-67-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1464-68-0x0000000000400000-0x0000000000940000-memory.dmp

memory/4460-71-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4460-78-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 118c7fde5774b2088cdb1f744d8473dc
SHA1 ce7a157580f16778682fd1cf847c3d691a478dcc
SHA256 452f5c4e55e086a3295de22b6ce82922408c3b1fdf75b3097fc23a588ddef345
SHA512 75fbd87d17d10c4eea0441a6f24ac90f9d0d45f9a69cba80f23fc40c9d410bec71943dd240797ac23c700a35abdf2c17591ac8820eb3864ac8d00e9f3478d947

memory/868-82-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/3376-84-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/3376-83-0x0000000140000000-0x0000000140209000-memory.dmp

memory/3376-91-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/3376-94-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/3376-97-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 9e520e9ba0b7c77ce330d3fb5b8726b9
SHA1 16e875414f2b264dfbffba9279734a3d5a56b0a4
SHA256 a1c727b556a2aa226bdb8a765d73f0413993608485be345a94ac7cb94ad698c2
SHA512 d5a451523d23f233299d4abd424427d00d9dee0884e4d12970b8c760579738a04d315dcfb5dcbbc3796a0a3e15fe34359411cc6b1203cf329d75fd69c32af4be

memory/1772-99-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/4960-100-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/4960-109-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 607f646323d65bec8d08c9fa906807d8
SHA1 1ffa372ea1af511bcdb00cdb913e153a32f86110
SHA256 f98bbac20325e07675a7b73edd1393c2560783e12c4ddc47c297e9046607cca4
SHA512 4514addd0ce1436edb7fb8566ba5a91d390d97b941439b1040892df21fd4a195fd02279544d0badaa5dfee41fb404342e2cd158472b9af8634da39dc13705b14

memory/4472-116-0x0000000140000000-0x000000014020E000-memory.dmp

memory/4472-124-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 8d8157a9ddfc00e5e4ceae8a3a45fdea
SHA1 d87e3bd405fb3c025aeb2e14114755c23bc4184a
SHA256 c02c29b92cae1d04e4178e8c2ecb295ec6a8ebcb53a26a0bdb897f5c1dd7ed6b
SHA512 9c20d84a123ca5ecec3f4c364abf937e7079546e32a4932a1e10bf848c9b929e3c11b1ce07177dd4a49ad2fd760947d0dad8d2d5b674da00c2a834ce97b4d434

memory/1716-128-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1152-130-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/1152-138-0x0000000000BC0000-0x0000000000C20000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 296fed4abf7e2ff53957bd51caea3538
SHA1 1d339286b388d159a31ada5c861ca9ff96d1ae3e
SHA256 5635c3a392f2df9891dcadf3aef3b56d2ba22a3898d6f6c8907c7c5df62359b7
SHA512 f7c47f6e1be561b5e21d63a74b50bc053b7175fe7189b45c4d6727cc9dcece9a14a1654aa66123878f1f0b4df4593288905dd10057d16d48613ab40762ba9568

memory/4460-142-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1220-144-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1220-152-0x00000000006E0000-0x0000000000747000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 4c61d4270c1a85ec9a73a342e2f3b19f
SHA1 a61609f7c558b1ff528d4855bcd68c0ca4831174
SHA256 7c674517a8d16e2f1d828d4d4dff750859e5c34175de8f0b5e17c3b2e384e57c
SHA512 87f32d2f4e24f2c0d4accc83b837ede9375fdb8962d3dc75f18589ce451222eac22ef93308e6a5e0d6798fb0a46850d50fd7ab27d1dc5d6c024c5b51eedf7dd1

memory/1540-157-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/1540-165-0x00000000007C0000-0x0000000000820000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 ed819c28aff4148967e54164fabcb4da
SHA1 7bca47f016f05b74a2befd1811b0c8f283738f64
SHA256 3a8e394315f618b31e5b69335b12823b59895fef2c75655def4f82f4ef1118a0
SHA512 de1bd24d43eef60f650d2e32b97c9ad4c3f88dbc69e638318785100cfc44edc3da530719b9c0112c9cb7b938f7973ee22df7166de747ed77735a9c0584070286

memory/3996-170-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4960-169-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/3996-180-0x0000000000770000-0x00000000007D0000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 32e814623d3f0f935b9989b941a409fc
SHA1 367c1c2fa81940e1624dcceb9e5f3e0af30b3b4f
SHA256 6be8ec886a7b8b20906d05be12eaa345f238016d8c54d1fe2d6145591b352f3b
SHA512 e8690dd6b79548b3fe63a8231963913070e8f79bdf0405b398c2ed9f8e228557e87c53e124642ecf2323fc1d28c18ff285806aaeac279957778013262d6f599f

memory/4472-187-0x0000000140000000-0x000000014020E000-memory.dmp

memory/4788-189-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/4788-194-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 abba1888ce77f4b856b9bd7a8ad275e7
SHA1 2ddf0da40c9bffead0615b6492a5219809ff550d
SHA256 9ca40baa2ad1ecd0e41f6c9f0fc7d2859957b12b1e5c6de2e23e4a81a0870cbf
SHA512 a2bf9e5f9a348e15fc17f2948085a16eb50a7d40589ab34d110b782145307559d999d97e07294fdba4d74ef4dd8db828af3e9395796a3f7f52c21d2ec274efa3

memory/232-204-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1152-202-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/232-208-0x0000000000740000-0x00000000007A0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 7768b0796e3a7044a7f9291b35478a43
SHA1 0b2ee50ff0a5dfd5337ef59751adec10a231ff8d
SHA256 a2b9a541fcaa084fc8a9c85de1dacfefa03342a538a8d41850bc631ff4bc8ef1
SHA512 5ce6240a9ced59da1255049b19f061672dcd796513828b18a0d055a1a3b62d2b25a03fd3eb282a62ff0e6322d70f434b5856b7a166a3b9e505f16a769c2b850b

memory/1220-212-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/4304-214-0x0000000140000000-0x0000000140241000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 b473a0217fa73372af75cca31ab348a3
SHA1 ddce904e064c4cf52cc9beafe2c79df00cebf40f
SHA256 454c7ffbd8733633b8686cbcfd4cc0252bf121d7368149d359172e5d63a33bf7
SHA512 3a464bc3eac2534c11b1470827317e15cc2043973fb5aa3c4ecc0a4476d97a793d385ae3453d790200e51aa537dafe4c2d5a1a1067d6fbcaf0de91052610e2a4

memory/1688-226-0x0000000140000000-0x0000000140221000-memory.dmp

memory/4304-229-0x0000000000E50000-0x0000000000EB0000-memory.dmp

memory/1540-235-0x0000000140000000-0x00000001401D4000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 d82209c7613bf0008922ca5ba19f8283
SHA1 ea7af98172ae1597375a246137c393ecc6a902a5
SHA256 240dd08673b48e13eceaf5e916b99dd7bf7bec1ed8bda77b27051737dd590693
SHA512 4f04275e616ab1572bb89df1bca0d60ced3767ffff4daae8c8e3d88f5d43a1ff72be1a2605d1e8f19fce588d10a922fdda5c8ace8c9bcef3b21d3ccfe935572c

memory/1688-239-0x0000000000710000-0x0000000000770000-memory.dmp

memory/556-254-0x0000000000BC0000-0x0000000000C20000-memory.dmp

C:\Windows\System32\vds.exe

MD5 f498700f521aa0a70795a00e14ef501b
SHA1 ad7ea6ef1c17edad0b1adbd21a868930cb203bf7
SHA256 8b7f3979d660a9f553c76e8ba0b4956605eac55adf918e3b8fdb23fff7aef582
SHA512 a9310dc77d9bb51fdb445b50a2a9fa685e18a0f91119e000495071991dedff79844c99ddfd9875fbe3ea7600f14acb09f6cd7ffaf4dca61156f483ec69e2a8e1

memory/1480-260-0x0000000140000000-0x0000000140147000-memory.dmp

memory/556-253-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 ea9729c2b61bf118cabcf479e95da9fa
SHA1 8561fae50aa8677862053537326b064c74fabd9a
SHA256 ee28850d8e2fbaf458b4fce673d175d4adf4691012b0a9f5ea9c25013c35bb04
SHA512 6872861a778e59be3dbfbf103f43061d40aaecc69978a1c2507311de2aa2ee07bd23b13e850da41ff2a8b6a2a8c2f4cf3b2075daf76d429111405bf7932c8f71

C:\Windows\System32\wbengine.exe

MD5 8d4aaddd0e535c793f6dcc7e439a73e2
SHA1 4848b7d85f4cdf0151da41ef886844c47462b309
SHA256 7babfcd5e2a694940660cb1c8d3d84a5ea4d1da646d102b9628d17a9496adfd6
SHA512 38b6ca7041d3b93191bc2a5c12d46084153e7beddaae46d8865e6ffa20fe1393e5eff368d15bcce5c2a8f40161ed151d0af3f9033f2f772a18b7011caed84f80

memory/1480-280-0x0000000000C50000-0x0000000000CB0000-memory.dmp

memory/5116-282-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/404-287-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5116-284-0x0000000000500000-0x0000000000560000-memory.dmp

memory/3996-278-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/404-290-0x0000000000C10000-0x0000000000C70000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 766c07bf072151498ab0685bb6eb42b9
SHA1 e672bddcf659374ddc218dae27c7ec2dc73d9080
SHA256 4fd28e8dfa55e1fc96bd6ea30640e80109447d7f7179bc23f6cf4d4ae2b4d579
SHA512 a958b5ea91c701dcc672f777c3de92ced0c90f4fe214675075149591d443be4b0a2b7d439e37264379e0aa27fdbe403c0796475e36837fbd33829bd9b3fcc869

memory/4788-296-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/2612-298-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2612-309-0x0000000000560000-0x00000000005C0000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 36b42d0e87691bc13eb09254bc5b2d66
SHA1 7fda94772855bc6e52787dd33116179b9351053d
SHA256 6e6dcfcf8e4104300f38a83752b6bc8968b098d47fab7a0c30e4eb3099aeba70
SHA512 4957328f8b390cfa4d79396aeae007f254ee59699761374e7200c740330053ee347837f4b30be79b9e11afa290e1f0742614f39d9cb9dd168c2d69cb03fe6b94

memory/2504-313-0x0000000140000000-0x0000000140179000-memory.dmp

memory/232-311-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4304-321-0x0000000140000000-0x0000000140241000-memory.dmp

memory/2504-322-0x0000000000850000-0x00000000008B0000-memory.dmp

memory/3996-397-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3996-404-0x0000000000770000-0x00000000007D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

memory/1688-6516-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1480-11037-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5116-12440-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/404-12454-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 967a3f4688003f68103c5e074e900367
SHA1 4921ea8cee40a17e76b9055cf7be313928c6cac0
SHA256 4bc1890b91eb0e135b0409f34af3b3bfa5edd161237a6d5ae8ad103cc30dfe4f
SHA512 7ea702cc7a994ec252a9e4756939e8d644c98428d7c722adb33ec5ab3b95b9aff4761449cdabb284b54478dacb4b932f80a04713b5ec872f7b09cc02f157a4be

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 5bac21e4a6373cea3132671e933d364b
SHA1 505e3be819d03a3fc31b02a4d6c18fe554f6e943
SHA256 b721c0e6372708cfbc16f3e9d017f98ac5f1ac40689826d1a6a72d92775316b5
SHA512 6a60d76291b8ffd813a28a71e6656b438ba5a66a3f57759f1b4d4649431bb236f5a723bf582765bb361df7c4e662146568a6430b4200c40c5dc38b057b0db2dc

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 dec30b06b9ebc0b3bcd5ccae3ebe73ec
SHA1 69cbf663653d4cd192c92120499085099c5bb6bd
SHA256 2a228c78ece00cf8928d9ce2c5706e892cdb9e3d931accd64d93a9c0304d4c7f
SHA512 6412c70ce25019e31d3a7b07f2db787bfd4b394edb30c86909d308ca1ab2faa0791081fe685b7458b924a5c313fc26f14a4b64f66582d4710da962a76ff92c5e

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 2f5d08beb16978f342b76012d0ce5f6e
SHA1 84389afe885a663ada6c106f69b4e8a11898ce96
SHA256 3b8bd4261cf47245a59f240b1940eeaa9034c8b5e2eb3ec1b4b01d4fc057815a
SHA512 30637b66808102ca8560a867862936d9b97721b82777a63841a2ffcda96087c9354d04d130789f28d2180c76cc21e1d5e2eac846f4d39d6b2e77c8fc43e5ff70

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 d32df1e7c79ec46dd0e8772c0c57c5e6
SHA1 4e0009b69ff5349242846c39971e27fbd456213c
SHA256 1befd8f23f27903204bbe7824b2bb66fcfad8932ae7d8a39d7eebd6ab3a8fa46
SHA512 1994d8bd0bd3a4fb3a9d6f55e76dd5922e1fdf51210f49c9afc0ab01bc141ab9ec716d70d4e5d77b185a6b0f950d01fa3cf61720c4fe0c36882c9d6c18b4dd0b

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 a1061f65e6abd7fa861539ceb5a848df
SHA1 a8300053d9f01e07e8078cdc9e2c02e74ab59e44
SHA256 3946763e0f6cee483528763f17bafd42ace81254cb9a424dae5cebf26e292446
SHA512 21f1dce1df71cd404750abd7a033ee20af04f9d23cbb4f7fafbd65098c947df5494673c795873110ffcf956fcf6a508e49b5e579a97cd7adbd9fc8616913c051

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 b5e84362c62ba44eacfc7bbc2c937edc
SHA1 7cd965f8d2325995164fa1567b96d3ec028ae5db
SHA256 6681a1c19c2db61b2b30613954f5e8ea688c3473d7706e5f0dbe9023113cc539
SHA512 bcbe5a6e5663674ed6b1a0a8cc7da88a885645a8669777c1845a172e52857755f1caa0e84a5b519217aad349f6b1f9a332ec440fc3fcf6d390369bfa041d010f

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 201ab8b04d8df27392c5981fc75e28de
SHA1 8c8e9b6d75f8da55424f230e2ca3bbec67a18e17
SHA256 ca2a53017cffb943641326740ed5b2dd6eface389c4ba30bcee80ab07543ccca
SHA512 34d9394b919180878ce5b59483a46be98573b951eb104016b4f77a4345822220e5669b234eaeccc4612e3f238438b1ea7d4f7d45df912e1519627f178d139ac6

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 dd482da844ccb7a2c3dab391cc06b772
SHA1 06f25024304dcefdc476eaf83a74af7db10ed803
SHA256 bf4c5e9d3cdff141ed39ec13a2af2411e6cef18dfc90399f7bd9f0da22a965c7
SHA512 1e7f82b3ada41ff1b31b9168ea8bb6a4feef6ddd773ec497acc5d6e8615664e29a3f3133af4823d757ca5afaf5df4ba732861e81f8195930a39871d08431d9b8

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 856e84c5be21b5502ff71033413c16f2
SHA1 fcca9cddbf52d76c582aa2aabc36d35651208db4
SHA256 883e7c6802b72165d2f400d43d9b63ecc8e6102ab031f4f1768d77eeb6cefba0
SHA512 66ea86df029d20d84f91f6db5f6adff2532e14dca0edf601e0962b0119a93a58dc90bc43ccab6588e3c1e4afafd9dfd94b78b0fcd73b4b1404784ec092bad116

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 9037da0ffd9bc17521c1baddd5f1f3b3
SHA1 a07a25d237e7c51a3d622a6ab5b6f1fef6b78470
SHA256 62055607892dd2e2501a1d1e9f661eed10b00df41122e29f39dbfb9403ae46e8
SHA512 5af58eb26df2ddfaa6e0371eb70ea239f9244ad4153caee79a17aa246375310efae2bf14777779f85cf873f03e2b0e3163b3245c17d2dc901da8403b63f210e9

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 f8c2f93dc7c80452f2478ecfc29130b3
SHA1 a0689a7fc71601ace0949d8f961ba5aade98144a
SHA256 ad114aa1f674a49ad6b28f28189ee71bfc8965ab34dbdc8d340ceb7aadbe7c8f
SHA512 f9ffee8c536f7c32d2cafd3f6ed89625e51d7c7295c86fa1ad3f3dd27da7312615ecf18bb1bf08f666b54642b13448c790708e722ec6c63c8caed48693ebf903

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 38e86fde2f30a1b7f78a149c9a4ad331
SHA1 960040ffa77d177e28fa8b14a5841acc9c47fe48
SHA256 df9d6efeb51632a5004ddcc821c09507e73df6cd40681bd628a2d5d635ffb9d5
SHA512 b649cd271d59469be0f3538832532b0bc452af63635709584cefa30bbbd8bb59e8743c88a77a341e8d927488298e0496a5d440acfdeca1859905a2fead144f99

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 f6bc13ed3958de51259d48f82509cf93
SHA1 293bb8d8a61bcdb05d55be2c12f27039681d72fc
SHA256 b2215d9e5408b90f1657319334b00ce0eb32c7603a2b4f7f71f329076a4b2304
SHA512 778336ff017b9deed844a88e20528e2a16f56cad17f24f5d44f0375ba4e86af6113d65c4d879fe7b1ffc33b0d5cf08a976a045e323df85d14c21fb781ffed2e6

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 61fb0a3eb25fecd9db48a94fe0660bb4
SHA1 899b94adb25270d001dc3b3614244db1ef48f7ee
SHA256 099e5a10ee6cb5ce3fba82195610459ccfd973f59b0c708887b215d8b0929992
SHA512 c9cbaa1db1081327371474d1f25db125ddcff7999f3653af09cbca8fb12547bee9d830c4bf62b298937e2bdfe45c13bfd122c714ada5c41e752e729f087926bf

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 59f80645c688717e6ed58b64670497f0
SHA1 a386b2c7606f8fe3fdb8fbad5a95313fd7d0d876
SHA256 30843f8ddbe8ffa1df1c8260fd475660502d2bab71c2455802ea0c913bfdd4a1
SHA512 dbaca31744dd80a0ed6576b2d84592d4dc5e492a0dcee676a9778233023fb15e51fbdd30d9f486241a40fe8088e0c3e74c019d99ec1d0ae213bbdc08e050faab

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 389f055361d4360ab73b07d5da1f03c8
SHA1 76ef686968b86d6f95ae5486d0dea96a0db5c3d6
SHA256 3bf4e1653b0ccc748e449ed9450bc990b0bd1a071e14910a1e843d1fd8e2edc5
SHA512 0bc234a8261dce257b33032f3c1e31b71d735132cfee0279673085a7820117a844866d7a9a12a649527b7b97db25a8f4ae93cbcd34cabafe1d7306ec275165c1

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 59c2a485794a40d499909e7f256638db
SHA1 dd7a70c8c0ca8163cce0a520a0523d05d2d35a64
SHA256 2baa7245b4a6074118143ec30ee68d21349affaa3ab2427084d1f6af55c12f58
SHA512 011c39f7e6535d0f1ab53db94d5e69681250c1368c3ed9873ca55c95372eb094f9486cfe52035eba0334109782f54213b0c2e74a2f49577bc2f0a22c68b23a9c

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 c369a0aa84ab4261721e4a81129e838d
SHA1 9194e8f89145aa098adb191ed4bbe8d2457a23bc
SHA256 ee567988bdbaf780196bbe46d07b3b9cfdab513b1b45106149010f4843bc432c
SHA512 e091d0966734448b87e09305b941be3a48eeea0082d6edeb2ffe2b9fc444d9597510c58beae257d3fc81647c37aeda2d117fc85da3bf2b96ff5e0e8af20a92fc

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 fff0403d663b07b1cf9bc2ea161d2f2b
SHA1 923fc4edb72b7a846f9f04ce3f13bc5f5660f94c
SHA256 b35750801d2662823b00dd61b4a9b68366542f7d2ea2194d56b99748af02bbe9
SHA512 b27d8701aad75a48c9fbc2774aea4a4e79bf0bd0a1bed41f18f5ad9b1fed5e3d4014fc439735061b3f50dc4b27182d0c03a75b42bd8564c2c919a3acfd8aab83

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 b4e14d29fb62c6770f48730b90264a2b
SHA1 6d5181a1b4900cb4f5e96eccf25e3597a73aede0
SHA256 ad3ee9d0234134c50a446d73d7d63c1cff1ae04c6ed8f1412b838a37b191bee4
SHA512 79e4bc83366a36d6a572bf8cdf28cc40cef850bb21ff7ae461abbf93fdb49173ee7c55d1f3d7e9f6c437d4526f698d8431be500ec2dc4d3d4cf266b513538489

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 517eb03507e43f4a8776bbd0b38514c9
SHA1 45081cdd83cf571b1860222fe3b79ea085e86ef7
SHA256 8398cf2d5397f8e97b291aa568c60535dd3b9c9924676408984863ce512e2cc0
SHA512 dbfab8c564b9ee9fcf3580770decf8e8685de391c2b3750103740d77062557b10f9de13787648eaf33e0ec129bc66ed94b16dc24c0aa9b51874bb3eec6796f96

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 e3a70673388e19cb298c293181c1fb78
SHA1 2bf1fb68799e7fbb2bd3d37eebfbc9620f1a84ba
SHA256 ca8fe9058b5fca47cff3c2fcd33e30476d196d305a011403b56e96fe1704a6d9
SHA512 c2a8d9024aed5c7d9616dca7c9e0e3484b89fb24f5a37076e351879339147b5f40147a1c577ec1f014d05714da9c44f0faf40d9d86f6c0e3d6d90c8ed8a60632

C:\Program Files\dotnet\dotnet.exe

MD5 718766f979d322d61dd33aa486178d0d
SHA1 ba55038f69e820fcb4833b89c0f4d1f0c8bcfe04
SHA256 8f36e7a3e3692927fb2dc2916e756cb1157374813a1f09eae077694202e5e2e6
SHA512 e6fa46bba3cdc553fc61ed55824a275d0788109d6b1d3ecaee95ff73e4aaef48a20d70e628e8b23cc4b45094fd62cb54f7ce21b178ce901ba2cee1a789ed3078

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 d13835a20229afc681a345653928af1c
SHA1 2d285e9662b0309668d902c81bd4907a9090336b
SHA256 5d4e9efad79e168d135aee4d9d85d81b10b144d4b278620140de397edd88ea35
SHA512 bbbf0d2ab9e213ab1858679db43453819c9941c0200fcbad35b297a10b5e44d2ec82e1288500f302873722a52205d75045989e9e23eac9480438309063f3019c

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d8c8c00058ebb6faaa494be5e13c1de9
SHA1 20e885e135443d2c38e086400cc546b6412b3e85
SHA256 34184fc421fa2bef4d11a3a315361b7389eb825eca4e289496a8de2a5d769dc5
SHA512 57d457ee0ea00006fd2ac41a4074122eef34d738061878f16dd2bd528941ef0df554ff4778a48f3d141688a16de4b886dc624fac66639d330d29a0d87550403d

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 d196ae689a69a0790102045dc4d88f72
SHA1 200869424ee5fa0db2148364a454e2af476e8bf7
SHA256 49f3c9730c14968ed80ecf82ba21439d143246ba204f33ab6b9cd6b7d5872e7f
SHA512 4b0d9c47bf0935ae4b7654f1b6eea63915e5d33517c1724008346b9b608d511c9780aebe9d91aa442d7a58db4f5193d0977d716b83c380dc84c1c671bb5697c4

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 1139a0fd13aae15eb9b08e7efc020b76
SHA1 58d6ed320267b93b7b358310dd7495702d88b393
SHA256 499ec34fb38bbf8b3d240dd4366203bc86ab623c2c6a950e3ec4663d2af8dde3
SHA512 428bcf700641c0b4aa2114be0dbb8cd4872fc187b822f8c43e46a79647a065e085e821b253189a18860cfcad30ab4497ee99197de197ad75a5f1f321bdfa4658

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 8c9e01480616ecf2dd4515b1ec5e9f70
SHA1 b7f64d25eb7daa3a92c78c6e9389aa69906ece6f
SHA256 2cb2e5c923c142df4dff64d1b0a8cb14c401e31a027adeaa4db1ff308d95a105
SHA512 3f82639e08b33740a259737b1a9e90b7c1cfd61b654e12720dcbd016875e94db2c0d12df6c2228cbb236abbe9ee89c259e48a8f31c09206f12f1ae6da909b168

C:\Program Files\7-Zip\Uninstall.exe

MD5 dfee2326ccf6815ff557cfb621a339f6
SHA1 a8d06823d59e1004732efc502a3a9ad9d5ea2ab3
SHA256 6c1f0c780b8d8b2bc6e0d9caadb86634240adbb1252e251f957337e4abc6d725
SHA512 c080b0b4f8424e5398c7a6356d4ffc1234f0779e2720f2ef90bc1ac68b69d8bc8fcb6a92389d693389b74ed030ce400e048e32cf37c0521bac5e3bbc49e4d9f8

C:\Program Files\7-Zip\7zG.exe

MD5 b603977cd604ae650dfab50a80dded33
SHA1 ab80d4fb611ba6ff6753cb1ca5edb8a6f1595ea5
SHA256 33a160661fcf339e96be9e7d0888acaa328bddc8a729bee93efa81ed74000c12
SHA512 af770ce3d55e70b01495472acfb8623e058df4ede4700ec9d4b50275d5c0dacdcffc3859e705d4f909c5cd5bd47f7bbb971ad40f299dd52f6125a33adb539149

C:\Program Files\7-Zip\7zFM.exe

MD5 cef4b9856da9e9b688def0db67e8a01e
SHA1 8ba00c2da6341731f051a84d2f2a6f4304e9b430
SHA256 5e7bba4c14bf0bbe05355c48bdf98b6cae00be8f9d861dca52a573a8a8e2ef8a
SHA512 c94328f41d6c09220d307a98a0785db2cee4b65e4614d076e9978d7011fa48a98ec1e371373d7c042c8d14697767de0984ca772aa7df120655a26f7772d39b87

C:\Program Files\7-Zip\7z.exe

MD5 0df33ad9451a69de4702584efd86158a
SHA1 c74682e126b132be9b4fb4d1b2a0e88a4e289e1b
SHA256 1bd59774fc47877dd22d65c5a8674ac6673331cfcc0cbe8467bb18aa67658264
SHA512 e944e78432961627dc6542477c7e4f680fa04c49a4753c1499b88ee9590d953ccfcc75cec190a495c9fe7364beb6d9256ef11ee956d49ddee64d2a2f70d14334

C:\odt\office2016setup.exe

MD5 e21c872c2fa0c1fd569429014a566505
SHA1 c778ba03cdccef7857821f0cb970f4882a188231
SHA256 17348a2c01c67d336bbd9d4b694a6a89caf4d53c9ad3a143c262b404ee39562a
SHA512 5cec05473141668fedccba738ca2c7f21498c1f1aecedbb4735b4e24114d90b847a80d92bdb648645833f9ecdbb3cbb4c90d73d22b6c35f6ccb988da60307fc0

C:\Windows\system32\SgrmBroker.exe

MD5 6885622127e1d4a748c3e865ace86f9b
SHA1 d12b2900ee34744da44021b5dc910f3b419d8ab5
SHA256 8699503b88270ee1d28c7709907bfac5dddd9c2f0322550a5e888f9869c2a8b2
SHA512 1e31dbce9bd668fd8b252b7a7a124b38a962bd3f37757adbd61daed52387dbb7e7f60c5a7174bbe530e3605142be7b70b3f3cc975453d6d453f30c9371776542

C:\Windows\system32\msiexec.exe

MD5 9a0a5075551f967405e4b0508053326d
SHA1 1cf1318bcfbf6721841e0b5ad68f0ff85bb444c5
SHA256 6b7f13f9b68c3dec264e3496cd51292ef4b42b8a9cdde71fa9dc82d4a29b1c72
SHA512 76986f97ed494b61b0e39a8ab9224bcdedb2165ca2bb8b38d38f732914be058d6fdec908ee4feb1687e3c591f1fa0abff927d2a57569b67df880b040890c0081

C:\Windows\system32\AppVClient.exe

MD5 90f2a45434aa5d7b60e8403bc247016d
SHA1 4407b3cf1179b13741f8baa164f51e75cd043b58
SHA256 df959f8ec569d6075b7a1b4cbaa8ab0c21a2dbd3b69262abfac7927c4fb8ad2c
SHA512 f5e3c764ee974e9cba21669e616467a1238a5370b88fae72b0deb1d3168f55dc6f603500fb18a8b9104c52d72112518c69f4701671ace2c157ad25ed63eca867

C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32

MD5 efb6e815a83a9222a7263e78209285f1
SHA1 e178c8468d4e2ac9e66e7cd597813e6d85b30044
SHA256 9d0a3df457493d2ac1dba90a89ad6b35d309951142c793bef247ce462a631a2a
SHA512 36b1ec5f4b045b026f80983f769fa20d9e301c6ed92a036629f768c13515393522123d6436f438fe4f24f9116c0c7908c4d8093fcca36972e12ec763a06e3c72

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 323181f4e9013b8b341897abd322e56c
SHA1 85e2e4a5d38c515185415bd4aa8d24f32d428fa2
SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
SHA512 24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004

C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_tray.tga_

MD5 7ecf5b072a3c49209af4710481dff5c9
SHA1 6b49560eb27b2d7cd169c066208d4fd3a4863f3b
SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
SHA512 ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262

C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync_posix.tga_

MD5 be3a210738638c4f33aa7e01cb475e26
SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_schinese.txt.gz_

MD5 dd542d7ca2128ef0e7c3411b5ab9e8d3
SHA1 0a98ce0efdb5fd75d3c697f06f3c084d5882dc49
SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
SHA512 0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85

C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync.ico_

MD5 da277b7a17374bde018ffab02015238b
SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdBottom.tga_

MD5 bd64c051ae2410eef96839a3cb7297f7
SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\cloud_localfiles.tga_

MD5 c4e538289a4c12da96cec77e7a3e36d8
SHA1 12d57144c0e79edbabc8033a9bf22b1720299f2f
SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
SHA512 db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffBottom.tga_

MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 5a5715177822e69c98aab578421ae78f
SHA1 175ea27d6ef6df27fae93a724c94b2c770f78205
SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
SHA512 b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331

C:\Users\Admin\AppData\Local\Temp\package\tmp\steam\cached\game_details_header_green.tga_

MD5 1ed17a7d11da47608f99d98a8d249e6f
SHA1 ea3d9e0de541be2a346e93e63286f0265ac302fc
SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
SHA512 e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7

C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 1d76aacf785a659652d0516daadd3a89
SHA1 8f1d8728fe05d7cfd0899af8575ee999e5cf0ce0
SHA256 2a1516143067ca0109b3aec30f08ebcaf6cdbd60a2155652e62e098f51a32e9f
SHA512 e76f4378ddcfd95bae7a768ff54fcbffbd38060276d0b0a852d7ee652f2f993cd498f3f8da0347be92f16088e6f713249205797336579d7de315e28122184ff0

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe58a3dc.TMP

MD5 46fa9c67b956b9d7c5638b790b8b86e1
SHA1 0d8e7939162d9dcf811916710d488e9338fe7adc
SHA256 975e1b17c5ab55240443938e6e6badde873b5e8a26e0504527410e2fa150b97b
SHA512 5c068781e42694560fd18d715c936b49f2c55d2357acc24486490c98ddf4751519439fc031eb9daf73eade97a578d3e312d604648b18c34b69aec5ebc5d074e9

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

MD5 43a444d4b3d7d2a985569262dce58d5e
SHA1 035ccd42305f7e2c105de72d99b15b93952ac7f6
SHA256 5a5f647b1ad61c9ba0b89e8bc05901d5cf15969932006d9ae43ef1a3374570d2
SHA512 df330d34b8bd6dc3529511659ba25f7f3e42e5d59aff2d1a035765cfd3401d7d48b280d5bcabb2a34d08ff682f04d7fe6da691f1cff3f02e65deb63a3d19ddc4

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe596095.TMP

MD5 e8d2d9f7aa383b08c812d00fde1291b5
SHA1 6bf7915fca67f7890c8e1cb528f9d1a829860da1
SHA256 896813932711a860c5017d40f81df0937031fcdc5253eb5e7138bc3b957bdc7f
SHA512 dc19f029ab99f005643e1a2fc23c64d4f1639cd01c2bfc02314339c8fbb627b4ec12fe2f31a9c7f8c2d6149bbeab0589b6f98230eff29c4049aa7d36fa453774

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 5b3755a335f86568e4349aaa10497e26
SHA1 5285a094cc2b06301e2b2f808e9be4693e2343a4
SHA256 d49096a8ba68810a8e8c3171aa39a445c1e37735154bcfbd220415e1091f9363
SHA512 f3834425981a2cfa9fae4c33bd08d11627dfb10ef281740e82ff27f4835191340cb15e074ed3a16c80facd745de3c4a88ed6616ea67d24420728c974a06f8ae7

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe59740d.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:35

Reported

2024-04-07 23:38

Platform

win7-20240221-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b38baa9e9a3c2c1c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{0970E2B9-3553-4723-AA8A-F69BA2A91E8E}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{0970E2B9-3553-4723-AA8A-F69BA2A91E8E}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{840F61EC-B78F-4376-B101-89725C2D05FA} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{840F61EC-B78F-4376-B101-89725C2D05FA} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2952 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 1692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 3632 wrote to memory of 3120 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3632 wrote to memory of 3120 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3632 wrote to memory of 3120 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3632 wrote to memory of 1472 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3632 wrote to memory of 1472 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3632 wrote to memory of 1472 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2952 wrote to memory of 4000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 4000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 4000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 4000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 6720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 6720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 6720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2952 wrote to memory of 6720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2080 wrote to memory of 6828 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 2080 wrote to memory of 6828 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 2080 wrote to memory of 6828 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 2080 wrote to memory of 6828 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe
PID 6828 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6828 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6828 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6828 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 4576 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 24c -NGENProcess 23c -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 240 -NGENProcess 1d0 -Pipe 234 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 264 -NGENProcess 24c -Pipe 258 -Comment "NGen Worker Process"

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=6828" "-buildid=1709846872" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2024-04-07_aab33557c85ba58681ae5a868881e1b8_magniber.exe" "-launcher=0" --enable-smooth-scrolling --enable-direct-write --disablehighdpi "--force-device-scale-factor=1" "--device-scale-factor=1" "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=DcheckIsFatal"

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1709846872 --initial-client-data=0x22c,0x230,0x234,0x200,0x238,0x7fef49eee28,0x7fef49eee38,0x7fef49eee48

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --force-device-scale-factor=1 --disablehighdpi --buildid=1709846872 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1092 --field-trial-handle=1208,i,10655423589679709768,13084601154772732833,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:2

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1658372521-4246568289-2509113762-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1658372521-4246568289-2509113762-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Users\Admin\AppData\Local\Temp\steamerrorreporter.exe

C:\Users\Admin\AppData\Local\Temp\ste

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --force-device-scale-factor=1 --disablehighdpi --buildid=1709846872 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1316 --field-trial-handle=1208,i,10655423589679709768,13084601154772732833,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --force-device-scale-factor=1 --disablehighdpi --buildid=1709846872 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1536 --field-trial-handle=1208,i,10655423589679709768,13084601154772732833,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.steamstatic.com udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
BE 23.14.90.74:443 cdn.steamstatic.com tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
BE 23.14.90.74:443 cdn.steamstatic.com tcp
BE 23.14.90.74:443 cdn.steamstatic.com tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
RU 82.112.184.197:80 tcp
RU 82.112.184.197:80 tcp
RU 82.112.184.197:80 tcp
RU 82.112.184.197:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 vcddkls.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 34.67.9.172:80 saytjshyf.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp

Files

memory/2080-0-0x00000000021D0000-0x0000000002237000-memory.dmp

memory/2080-1-0x0000000000400000-0x0000000000940000-memory.dmp

memory/2080-6-0x00000000021D0000-0x0000000002237000-memory.dmp

\Windows\System32\alg.exe

MD5 dd88ca85efd6fa0633a42eddac795ea8
SHA1 17b68e2a10eebab9f981a951994e786490cce2cd
SHA256 cb8f2de25fb1feffcef4fcdc4aa5ba39bfd83b126323dddaec2fdc836f0af253
SHA512 305086012b0bedc271d230c863d6c1e5fceafe368d1c6f44f5f8008ddb169083ee1dea36b9866e5a7e6e7ac68f9318e04b9a4b3e575c3c933455f5e0322e0f3d

memory/2024-12-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2024-14-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/2024-19-0x0000000000820000-0x0000000000880000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 649cc25532fdc588ed49966742a7e9fe
SHA1 43175a0f20f09e33f2e124f108a98873b49698fd
SHA256 6b520684c5f1db9402a6f1d1611e9e9109d1944c07d5457838a537bd26ce76b5
SHA512 04719bcf207b9fb5f0fc2dcb30b6cf7b1109a80931d65b514e909606d12511411a083b4bd2fa6d64fdd777baeec3c3f7723b9a5642c7c51cb4b8689ded195ad2

memory/2836-25-0x0000000140000000-0x00000001401DC000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 3449d2080e4b7486d3c6fb77bf90ce15
SHA1 d73720ed8527031ade9a64dc709b955fc590a942
SHA256 9bffd1032713312b5878d3fe66dc0c5ea77c2db7d08900f791f1b8e143eac609
SHA512 46a18b81f8d745676f69bd38aa425fd779e3952f8b8a345f2b4b18a97251368231ee22f010f40500c04051c353239cb547924bd187826a8147ba550de7a96e5b

memory/2720-28-0x0000000010000000-0x00000000101DE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 b7fa57b3375336c75daf8e8e608ad0ce
SHA1 c061b4ee8103d77dc6945433d068a443f794f435
SHA256 07f9840e0d74f9f6433ec5a8416285534d4047f14fecb562aec86aefcbabc24f
SHA512 569acaac8054a95d34fc718b878464b1e9c4afa0acf6b423632b8d9c6ecfc5b8e54fcf68523441382f34b41bfc8aeb5e0c443494b503e6bdf86b3ada8d3ad0bc

memory/2744-37-0x0000000010000000-0x00000000101E6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 25c8b8a7fb9c54bbdcfc788b561a5b23
SHA1 f50f9e6db1f421e7c0ec8b8487439ed4240e83b1
SHA256 4dd0ef38b4d128d5e75b7cc7805d452446418fe518d8a8349ae77b697d7b6213
SHA512 62e4f435197be0ca7a59138216820657e473c820cb19a8ab93b4dfb184dee8035f9bb9e1cde740b5c856ecd9fa5fe556f315650e5edc9249aebe8ceb88a654f1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0c16fac5f8cdb2ca77c397e50153db42
SHA1 4f10af88981d6ecdeeb66fec093eac5350050216
SHA256 26814b6680fb6fbead5740936c9944b9c3c06f4a817e4cd3bc3cbdb8d05a9bcd
SHA512 7c13d889bba4313dc2b372913430217811bf96f674a238002ad10cb1fc01846bd0ce5d19d3fbdbddf3b39fc6e093ba7db7ccb9dba8bc06a956ec61466f3d94d3

memory/2952-46-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2952-47-0x00000000006B0000-0x0000000000717000-memory.dmp

memory/2952-52-0x00000000006B0000-0x0000000000717000-memory.dmp

memory/2720-54-0x0000000010000000-0x00000000101DE000-memory.dmp

memory/2744-60-0x0000000010000000-0x00000000101E6000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 4daf380126c6527569a65a064b403ccd
SHA1 e65fa13c72d122801b9559857d9e178ef532a501
SHA256 fd17234e9bd3b32056fddea4dea4776a4a1d9b8985bfd282d131fe4af11911cc
SHA512 c996bda5a7667ffc8194016cc5d698cf3f5f8f07120631c9e1af01fe974c9d119d46a7b1f00c5ca4e6f2aaa2bd1aa313a5239d70d62cc2dba70521b59de4209d

memory/2608-63-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 9580c38a67de14185cc0e3ad9139afbb
SHA1 1d7f70a727ffe5dd156d9d9d98ed96b46fd2edf1
SHA256 40e39dfa31869b0208c2974638e7c63d65f1055850cd4bd21bc81b91b528585c
SHA512 a013c3b377019596b9c26a98e8915abf3a239c65177bdce35ecf0d6bb5b407f416824cc57dd00ae8a4a6cf4d63df8bce1a535c80401ea9ad834093a270862fe6

C:\Windows\ehome\ehrecvr.exe

MD5 3c8b7b544cfcf2b43344fb1fcb1e74cc
SHA1 0e8da883fd99f5dab1cae1ddf0baeddcd701281f
SHA256 4c8186e726bad530d451345b1deda9bd857d8b73b2eba0b8cbfdd078051b80a4
SHA512 8098e6fa31cf0131d7d42376c874bea7c542e2d645df69d5f0504011896b970d18dd27ac627d6eccbfea2f4d2e44bad84cab837af8f0b9d02bf00960847c4303

memory/2892-71-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/2080-73-0x0000000000400000-0x0000000000940000-memory.dmp

memory/2892-75-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2892-80-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 8e94b85b7dc322f503f6ee5c9469d04a
SHA1 155133a1a808e0ffc02679a4b103672f3739bcb8
SHA256 a5f37e5f5b05826af4842dd1a124f09a69dbbf8c7ef8da5e372d8cb99752e21d
SHA512 b2da8e8008b95ddf858e3a65d18616715314423f6b8b21a69b1246c956c6a26e95c5d0beddfbb3d8118ad55968fd8b96541a01a5ff5377a2f4d6b4848c71f6bf

memory/2024-86-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/2892-89-0x0000000001380000-0x0000000001390000-memory.dmp

memory/604-88-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2892-90-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/604-96-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/2836-97-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/2892-99-0x0000000001430000-0x0000000001431000-memory.dmp

memory/2492-104-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2492-103-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 0df6d7b20bf9938e3816679747b2b658
SHA1 8b2730fbfcbe5b1e2a94214fbdbff2f3f5030635
SHA256 e025afe763e9aae7085498714b6fb0e9300b65a6f86a721e2b80d94574cb0bb8
SHA512 af6856e94abef5f97446d1acf9ecd1f9059bea48b30cfe4d69a8cbd7ada89394d115d6fbba48ebaa2fc51de5e26221defbb071d693caca8c9f4c3b05398fb388

memory/2492-110-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2952-113-0x0000000000400000-0x00000000005E7000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 742c0cb6cff9a17d2cee03a595fa15f1
SHA1 ab0a77929fdf0a85a9540eff642a0ee77861fef1
SHA256 e8f679188fa6532ff854adda5e8d4a48142666acb862dcaf766f14a7c693bf38
SHA512 99745c917733d7e03dd765c82f66e973e05a698433fc9c1bcb1e2fa101bfc84c1c3891b8ab22eb2fb403709b55c6d8c072410411a872470fc7f4539842cd4d4b

memory/2308-116-0x00000000003B0000-0x0000000000410000-memory.dmp

memory/2308-122-0x00000000003B0000-0x0000000000410000-memory.dmp

memory/2300-123-0x000007FEF3CF0000-0x000007FEF468D000-memory.dmp

memory/2300-125-0x0000000000A90000-0x0000000000B10000-memory.dmp

memory/2300-126-0x000007FEF3CF0000-0x000007FEF468D000-memory.dmp

memory/2308-127-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 bc1fa3884617f6655376f64feea1c9db
SHA1 a01616471baf5371ab320b0b984ade28d0234021
SHA256 6ce223e726d96a959e5f77307ec20f5cb14963e2bfeb81fa6b456d03f6832a95
SHA512 7295f7923a85c4d505738dd82de9e5aba761f8604d08df87af0591659fd41990cfa55c853efb123ae2944a17574ae85258172f0df400e92f6bb09f202c98d88d

memory/2608-131-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/1828-132-0x00000000009D0000-0x0000000000A37000-memory.dmp

memory/1828-137-0x00000000009D0000-0x0000000000A37000-memory.dmp

memory/1828-139-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2892-141-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1244-147-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1244-146-0x0000000000BC0000-0x0000000000C20000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c7e3366c957011929ab4b3924b5d171a
SHA1 ddb69ca3579a4dfe9e8d673ca54aa7adb37904ef
SHA256 0960e66de3196d9c3871b4b5d3f113f787b3d4b7a45931f84449228fccf3207c
SHA512 f282240bcd21ebe21091d8cbb6e669f206d9ef429891652274e45f1de8ce8fcbe19347bc0cb301ed45397be15b555a5fc174f66a4e44148f215e248bc7cb18ce

memory/604-155-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2300-157-0x0000000000A90000-0x0000000000B10000-memory.dmp

memory/1244-156-0x0000000000BC0000-0x0000000000C20000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 601587165452d8f5a50013607a25977a
SHA1 78f8736bf49bb4937a4adbb8e05398bbb8770414
SHA256 c8d22490ebc995e70bb3e5c6a2e1827d2b9831c4276bdc7d20e9b865515025a7
SHA512 c2d6333b77d92f244cd7d6a34274053d8c86e4e35a6d75d50c33295555555ecb462555bb28a3225964f49714ec69f2096c67feae96ca89b38aa0b776b8345057

memory/2892-162-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1656-164-0x0000000140000000-0x00000001401F5000-memory.dmp

memory/2492-172-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1656-173-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/1244-176-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1244-178-0x0000000000BC0000-0x0000000000C20000-memory.dmp

C:\Windows\System32\msiexec.exe

MD5 43551f6c1c973b48cff22f1bfe17105b
SHA1 aaa7447b8a2632165adc6c8f7e3e454dd173b1c7
SHA256 80b48eb696351d94f56be4e3962f0802124dd1f52de9b774f31c1def99780d84
SHA512 6d57a03c46065b05bdc102618b3311922be45e15ab9b8e82ee50695d2c0c868c80bc58fdc8c18773e62379fe2a549fd1406ff6759a23aeeec06e6c47433b87ab

memory/2300-184-0x000007FEF3CF0000-0x000007FEF468D000-memory.dmp

memory/1236-185-0x0000000100000000-0x00000001001F1000-memory.dmp

memory/2300-187-0x0000000000A90000-0x0000000000B10000-memory.dmp

memory/2300-189-0x000007FEF3CF0000-0x000007FEF468D000-memory.dmp

memory/1236-192-0x0000000000690000-0x0000000000881000-memory.dmp

memory/1828-205-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1236-206-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2548-208-0x000000002E000000-0x000000002E1F4000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 f674a2ff87c94720194611ead06e74d8
SHA1 2421896ac66059818b3a608c921a17f06bb51993
SHA256 56e2c4eff24f8f38fa1b8795b5c09386511835531b38068006a53b579afabd04
SHA512 5e8c181c12b5cc4617eced8ad6977c22a462329368512528dc743d3f8c1a95f6ae3542d03fa55a6ab09d4364db7ef7366172b2defcd61fbf9342afdbf645702b

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 e98ea99503a6d7fd6d45b172ac5ef144
SHA1 df0038e08650e652b5f48048e4b013267f4a9400
SHA256 b160d061988659b2bb9185c626d782a74059713ee69aa88d362c3b988dbca179
SHA512 955f72264bd6e8fd3f264fc2da345d195d3bbb31459aa209a110ad33b364a6d2f40f8d9e4d967dd00d63785ebf4c57683b47888b91702d4974bf77498b05e5a4

memory/2372-218-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2328-230-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2372-235-0x0000000000530000-0x0000000000590000-memory.dmp

memory/2300-239-0x0000000000A90000-0x0000000000B10000-memory.dmp

memory/2328-241-0x0000000000860000-0x00000000008C7000-memory.dmp

memory/2372-243-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1656-244-0x0000000140000000-0x00000001401F5000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 26461615698f5f31415db4a7e4c01665
SHA1 eb767e16f0e1244991d521b33dfb630f54a5aa7f
SHA256 cfd4cbea0a97d5578566b796dea96d31ee26739c4e7485f6e12cd2f2ee0b7683
SHA512 d1d76c094a96cc98ddd1229eaa85fa9e4356731df2a46f7ae73f020bfe3333ccf4d2755e41385ef99e2430756e0825f70136b0fe6ed68a6f077f7b5c1c3493c5

memory/2328-247-0x00000000724C0000-0x0000000072BAE000-memory.dmp

memory/2412-248-0x0000000001000000-0x00000000011D5000-memory.dmp

memory/1236-249-0x0000000100000000-0x00000001001F1000-memory.dmp

memory/2300-250-0x0000000000A90000-0x0000000000B10000-memory.dmp

memory/1236-252-0x0000000000690000-0x0000000000881000-memory.dmp

\Windows\System32\Locator.exe

MD5 f5a77b215da42c6b7e0a11c3c9e28525
SHA1 814956df805529fdb361b9d58dffcaaeac12fe93
SHA256 3ac581f10a1ee3cf24522962049b1617b71371192e84daffc48c31ffa1cfc87e
SHA512 09aa62dc5b19a30a4bfddcb63e8fa0a612958c77c0dbd16315461d6907d5e01d6f4eb2dedb992a486e4f4c0220caf9fffcba80a782f3dd51e1131ab6492987bf

memory/2372-259-0x0000000073268000-0x000000007327D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/1028-269-0x0000000100000000-0x00000001001D4000-memory.dmp

memory/2548-274-0x000000002E000000-0x000000002E1F4000-memory.dmp

memory/1028-275-0x0000000000490000-0x00000000004F0000-memory.dmp

memory/2372-279-0x0000000100000000-0x0000000100542000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 22e9cd10608184071cf774e34640010b
SHA1 5b489389718dd148571b7bab16c612c175d57662
SHA256 03e3c33db2a0805dabfa55b1a15579278caf3512b2dff7871db6ee219a45954a
SHA512 f746d0f430039bd2e9c355778df4522bd170231b1dd420d8554d18a6c74b64b864cec0c5c26341fdca3b033008856e73c01e71a467273d11af5833c4f249965c

memory/2328-295-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2068-300-0x0000000100000000-0x00000001001D5000-memory.dmp

memory/2372-305-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\vds.exe

MD5 f62f5b1d4f5727a8a90b2cc34b484448
SHA1 368867c4c4a7c306ab7d108e92d1c2825b4b33b3
SHA256 9330786212386f9c0366438911b97ccd9200bf4634eb6d885366958e9b28d7e3
SHA512 c4d877858a31f3b2c877ddd62aa7f4459e8bf78c52d57093ad7509a63c4d31584fc5115ea9a1606146a57592585e757e5b3a1817c1fcd125d1f6ec0c9cadd705

C:\Windows\System32\VSSVC.exe

MD5 1d71757061b93487a72136c53ee21ced
SHA1 34c1ed17d2b045e0609b93006cc75f17d345a8aa
SHA256 9c3861cd8abf88c7671b80f80ace2a90db8913cc7c681101a0fbd1a2fff99cf2
SHA512 026f06d0318d531cd1b6f942c35ece59873949625b19722ad096f1b3d2bd7b28e8d25a29087c1b94005f74b820c472ad7cb89929536471458ef86552dd1d0bbe

\Windows\System32\wbengine.exe

MD5 11b44ee0abebaabb2fb33820f87783f3
SHA1 178480a84c0c2b6d3a6a95cf0bddcfa08e27d987
SHA256 efb7d74be0b0536a817f6cc6d51ac579e15782cebe1effb3684f653af6e81e3e
SHA512 c9a6b343a3c6dd5861291b19f9dc10c58af68fc79ed5a516f18d4e2a5e130ef27a89d253551f30cc31c3f50538a2402e595d93db6587228bac05dda41ec2f2ba

\Windows\System32\wbem\WmiApSrv.exe

MD5 296bb58e53879ff387138af42b40106f
SHA1 dc1d17b21ee887d0ff3d289a90eaa6594ab0bae2
SHA256 df0bc1bd7d0ee12337b3354c8b6a1e7383a7094b754edd21554e52e5d3a34dc3
SHA512 b1cedbb2a249c3405158bb30498bbb76fc69355897258604d5f3aff9e58d82ad328ec73fd1675c769a68afdfe91087edfa6f66b03ba726f5d92b6566396af17a

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 88675a314cad44bc2d04d4d23d94ed95
SHA1 5869bb6a10300c89292dd5f9e72e078d47fa388f
SHA256 9755073b3fb4f5c2c95472df42af0d25f28634eefd6f951050fb5b8cbc7fc853
SHA512 3c63b643c39beebfe37aab3a2f46080a39eea13140486fd6682e6adb2ad58d8d3d5287b1eddc49f3d971b44c640e1216c43eaa74e22ee7ed70dc0eceab2dc75d

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

C:\Windows\System32\SearchIndexer.exe

MD5 01a14b0f0ef61a1d607bda4251b72b6e
SHA1 b063d32e0b2fd7dc40961543e0118f2afdc95929
SHA256 b95dec8282180bc1772ca437e7b91b61d0fbfea3f9f0ea148232b3a2d1aa8b75
SHA512 5fc0802996d37910a054ea19d840479c109964c704292d4a53cf2dba6c1b4ebd8156b5c1f9bb34713fc2818bd68ebdef5a2f16fc6b8b43fd62cb47eb9ce5c14e

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 0b3a7eb6c9f30115d74e509f2e72821e
SHA1 9a1e5718d56ccad808b035f7b54f4b67a3d1ee55
SHA256 5aee9b507e4d46dafcb19ef04466e04aead79b3811b78f90dd5358eb677f9499
SHA512 33846ae0ddd896d55080a13461766b7714685d25e6b9c9db4dd4ced080d61d62d7ea8fb349bb2054e957421413c137dff7edc7f96d50e3ee769c8366b554c171

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

\Windows\System32\dllhost.exe

MD5 5cffe2146d04aa99330cfa4240012624
SHA1 ff50fa4f3a6798b095d17ef77371e8c408376d97
SHA256 ceff6a1e8d4a4c0956047fa772a91dfaa52a16d06dc105e037db2f344f39f6ee
SHA512 ef00b26937540e78862f886a4a5f4e7a767527798c4e1761792017fd69a39d7c50cf972c858edaa8e6bcc0884d4fcd33f7ae34a8cbd3e3845bdedc7f1d0a598b

C:\Users\Admin\AppData\Local\Temp\crashhandler.dll

MD5 921ecaa849aa3eebea83cc117f057bbc
SHA1 b7eac57ca1e82b1011379893c88c76906b8c6833
SHA256 956264d928cc41776196b6a8162bf5895e0f093cc8049842fc90ad55e8c2f198
SHA512 2ea60ab1c5119254c38e136c3f1a88450fc0256fe5dcc621dd42235c72f50ef5ae2cf8fd481ee0cd663ee8173c09522fc7e11d72101072617d40ad193af9b3a7

C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt

MD5 da6cd2483ad8a21e8356e63d036df55b
SHA1 0e808a400facec559e6fbab960a7bdfaab4c6b04
SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
SHA512 06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.manifest

MD5 efb6e815a83a9222a7263e78209285f1
SHA1 e178c8468d4e2ac9e66e7cd597813e6d85b30044
SHA256 9d0a3df457493d2ac1dba90a89ad6b35d309951142c793bef247ce462a631a2a
SHA512 36b1ec5f4b045b026f80983f769fa20d9e301c6ed92a036629f768c13515393522123d6436f438fe4f24f9116c0c7908c4d8093fcca36972e12ec763a06e3c72

C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt

MD5 01500a883894fb17318c270951bafccd
SHA1 afd8d7fb980002186894fc23a132d9bfe16da91a
SHA256 c87d1115c2cd680504b14e02afcbedfede4aaf940a8e38f3a96d8478e4ffcf0e
SHA512 22d1dac01babde8224d4e9cbf712c28efc2dd69531a9b6d91c9d52f0fd5956ab97a8cb61b259cf66461bc2885080b80aacc059c9931f649f37daaaede9845c52

C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin

MD5 a1a24eb6ea7c8f698257c581ac77e6c5
SHA1 632500550b55c11335778a4b64f64cce568578cb
SHA256 d775348840b6bc74c309c53ed90ec2905d577d4f38d5210424763106a8c4586d
SHA512 4e39dcfe388c67767d56733ccfb33e879eb670ebb8ff22dddc940c8d077d9e312a7ac5dfa53de0270b2e5a25e826e4dd162c59cf7ea827eb30c7357310321bdb

C:\Windows\system32\fxssvc.exe

MD5 b6d6f3fa5f7a59dcb549b5fcd5438a5d
SHA1 686321ef77a80151165eea64dc488e1c76bb635d
SHA256 a75b5ad4dc0a10182daa5f3e82dfa15ff36ffc9995404d82fdf433fd0e8b71d5
SHA512 cb04556061a6db188e06972da17b658bf96db0591595f1cf3748cfe01211b31fb19b53d6320b4d646dfea409be0353d6654c88d06322a7f8e1261c6000c77904

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 8a3105668c6e1a56f7384a0e571c69a8
SHA1 a625c99aa33312e04f3ddf66a3abf5bf6693b8aa
SHA256 6bf2b8cd0a3ed2031685dfe104266bd24fad36b406192f48ba63149db5524c19
SHA512 d62e25bf86775d3e0ba6f4e4396a3b4c57d52efb2c63b7eb6def51b1ff6a53ba3cf07ef4934c4792d0461beb68d1ed7ce75eeb23795989280b8e2f9e76ba8f7e

C:\Users\Admin\AppData\Local\Steam\htmlcache\CURRENT~RFf787df6.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23